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Nuclear safety concerns can be thought of in terms of terrestrial, unmanned space 
operations, m ann ed space operations, and Moon and planetary bodies. These are 
overlapping in many respects; however, there are unique aspects associated with each 
area (Figure 1). For instance, for terrestrial operations, one must be concerned with the 
anti-nuclear bias and the strict laws that must be adhered to in order to protect the 
environment and people. For unmanned space operations, the main concerns are related 
to low orbits and final disposal. Manned operations add a new class of problems 
concerning the safety of the crew. For instance, if a nuclear propulsion unit fails on the 
way to Mars and the crew keeps going with no way to get home, this is not acceptable. 
Surface power supplies have their own unique features, but these are a subject for a 
different meeting. 

When one discusses safety of nuclear power and propulsion, one observes overlapping 
and unique areas (Figure 2). Nuclear propulsion rockets have to deal with hydrogen 
exhausting out of a nozzle that could contain fission products or radioactive materials. 
Nuclear power systems need to be concerned with high bum up and fission products and 
actinides formed over long operating times. 

It is highly desirable to have a set of generic space safety guidelines. However, such 
guidelines do not exist. One document on safety issued in the 1970’s, OSNP-1, includes 
an overall safety philosophy that pretty well summarizes the U.S. safety philosophy. It 
states that the policy of the United States for all U.S. nuclear power sources in space is 
to ensure that the probability of release of radioactive material and the amounts released 
are such that an undue risk is not presented, considering the benefits of the mission 
(Figure 3). Each program, such as SP-100, includes its own version of safety 
requirements as part of the specifications. 

General safety design requirements are given in Figure 4. In case of an accident, the 
reactor must be maintained subcritical if it is immersed in water or other fluids. 
Essentially, this relates to launch pad abort situations. Next, the reactor needs to have a 
significant effective negative power coefficient— unfortunately, what is meant by 
significant is not well defined. No credible launch accident may cause criticality relating 
to fires and explosions that could result in a critical reactor generating significant 
amounts of radiation. The reason for no reactor operation until a stable flight path is 
achieved is for ground personnel safety and safety during launch aborts. The reactor 
radiation levels are very low prior to normally planned operation in space. Flight 
qualification will probably include a zero power test to check the nuclear physics of the 
reactor, but the radiation levels will still be sufficiently low to avoid the need for special 
procedures around the reactor on the launch pad. Two independent shutdown systems 
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will ensure that the reactor will shutdown when commanded. Independent decay heat 
removal paths are to avoid core meltdowns in case of a failure in the normal coolant 
path. 

One important factor in preparing safety requirements is that each requirement should 
have an identifiable contribution to reducing safety related risk. The requirements 
should be generic and not specify design solutions. In other words, safety requirements 
should address safety issues and not particular design concepts. 

Undue risk is another concern in arriving at safety requirements. There is no legal 
definition for this term. For some, one in a million would be considered an acceptable 
definition. Others would argue for some other number. Obviously, the consequences of 
an event enter into what we accept as undue risk. The fact that we can not quantitize 
the definition makes it difficult for many engineers in system design . 

Terrestrial safety factors are given in Figure 5. Testing nuclear electric propulsion power 
plants will require at least three independent barriers to radioactive materials being 
released to the biosphere. Also, there will need to be an independent decay heat 
removal system in case the primary coolant loop fails. Additional safety controls and 
instrumentation will be needed to monitor ground test operations. 

SP-100 flight system requirements are given in Figure 6. These are part of the SP-100 
requirements document. However, the document tends to include design solutions as 
part of the specifications. Generic safety specifications are preferable. SP-100 provides 
a starting point for nuclear electric propulsion safety specifications preparation. 

For manned systems (Figure 7), the safest response to an abnormal event may not be to 
shutdown. If a habitat power system going to or on Mars is shutdown, the crew could 
lose their life support equipment--not a very safe approach. We are going to have to 
think about how to continue operations, even at a somewhat reduced level. Reactor 
scram at times is an unacceptable safety action. 

From past programs, we can look at lessons learned (Figure 8). Safety must start with 
the initiation of the design process! A systematic determination of the effects of all 
possible failures is needed right at the beginning of the design process. Countermeasures 
must be developed for significant accident situations. The cost and benefits of mitigation 
need to be assessed and appropriate remedies applied. Safety must be given more then 
lip service and must truly be given primary priority. 

SP-100 has recently performed detailed safety studies through all phases: ground 
operations, launch, flight and disposal (Figures 9 and 10). The issues are similar to those 
that will need to be addressed in nuclear electric propulsion power plants. This has led 
to many design features (Figure 11 and 12), such as two independent shutdown systems, 
control rods in the core, a special in-core method of cooling the system in case primary 
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coolant is lost, and a reentry cone around the reactor. 

During ground operations (Figure 13), the key concerns are to prevent accidental 
criticality, avoid loss of special nuclear materials to terrorists, and ensure that radiation 
levels around the launch pad are sufficiently low to ensure that special precautions are 
not necessary for worker safety. The approaches for accomplishing safety, as given on 
the figure, are well known. 

For launch operations (Figure 14), the key concerns are to prevent accidental nuclear 
criticality and to keep foreign countries from acquiring special nuclear material. For 
instance, if an abort occurred during launch operations, we do not want special nuclear 
material ending up in a foreign country and starting an international incident. 

Approaches exist as to how to address these concerns. Redundant neutron poisons can 
take care of preventing accidental criticality. In the NERVA program, we not only had 
the control drums, but also had wires in the core that would be extracted when the 
nuclear stage was separated. This provided independent redundant safety systems. 

To ensure that an abort would lead to nuclear material being dispersed over water, 
on-board destruct devices are used. Early launch aborts will end up in the Atlantic 
Ocean. Later aborts have sufficient momentum to carry the satellite over an ocean 
where the destruct device can destroy the satellite. 

In flight operations (Figure 15), the key concerns have to do with unplanned reentry into 
the biosphere and crew safety. Unplanned reentry can be reduced to very low 
probability levels by selecting the flight trajectory to always move towards a safer orbit. 
Interlocks can be used to shutdown the reactor if an unsafe condition is sensed. For 
crew safety, either redundant systems need to be supplied or means to continue to 
operate to bring the crew home. One must decide how much redundancy in engines and 
power plants are going to be required to get home safely. One concept is to use seven 
engines with a two engine out capability. This changes the thrust level and design 
complexity of the engine and drives the whole development program. This issue is 
important to resolve at the beginning of the systems engineering process. 

Final disposal (Figure 16) must be considered to avoid reentry of the reactor into the 
biosphere or contamination of low Earth orbit. The approach is to avoid bringing it 
back to low Earth orbit when feasible and to select orbits to minimize risk. Returning 
from Mars, a nuclear thermal rocket can be disposed of in deep space with final capture 
of the crew capsule by aerocapture. This way, the nuclear thermal rocket can be 
disposed of so that it never passes in the vicinity of the Earth. 

Perceived safety (Figures 17 and 18) is an interesting subject because the public’s 
perception of safety is not the same as actual safety. Figure 17 shows the real safety of 
SP-100. It is significantly safer then a transcontinental aircraft flight, diagnostic medical 
services, radiation therapy or lifetime natural environments. As experienced in the 
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nuclear industry, the real and perceived safety are often very different. The nuclear 
industry probably has the safest record of any major industry in this country, but if you 
ask the average person on the street, he probably thinks it is more dangerous than 
driving a car. Perceived safety is an emotional issue and emotional issues are hard to 
deal with. However, this is something that has to be addressed early in the program. 
Reducing the real risk to a very low level helps in reducing perceived safety risk. 

Turning to licensing, the users must know that launch approval will be granted in a 
timely fashion (Figures 19 and 20). A procedure is in place to accomplish this. The 
Interagency Nuclear Safety Review Panel performs independent safety/risk evaluations, 
the agency flying a payload requests permission for flight, the Office of Science and 
Technology Policy (OSTP) reviews the request and makes the launch decision, the 
Executive Office of the President makes the final decision if OSTP feels that it is 
appropriate. 

The NERVA program design philosophy is given in Figure 21. Safety was a driving 
force, in the flight engine design. The NERVA flight engine program and safety plan are 
summarized in Figures 22 and 23. They included detailed safety analyses and 
experiments and a requirement to be able to continuously provide 30,000 lb thrust in an 
emergency mode. 

In summary, potential solutions exist to reduce risk to acceptable levels. Unless safety is 
considered from design selection and initiation, the cost of safety goes up dramatically. 
Not only must the safety risk be reduced to acceptable levels, it must be done in a 
manner that the perceived risk to the decision makers and public is acceptably low. 
Licensing procedures are in place and the duration of the licensing process is 
predictable. Users can count on approval for launch if procedures are followed and 
operational constraints are similar to chemical systems. 
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GENERAL SAFETY REQUIREMENTS 


THE POLICY OF THE UNITED STATES FOR ALL U.S. NUCLEAR POWER 
SOURCES IN SPACE IS TO ENSURE THAT THE PROBABILITY OF 
RELEASE OF RADIOACTIVE MATERIAL AND THE AMOUNTS RELEASED 
ARE SUCH THAT AN UNDUE RISK IS NOT PRESENTED, CONSIDERING 
THE BENEFITS OF THE MISSION. 


OSNP-1 


Figure 3 

SAFETY DESIGN REQUIREMENTS 


. REACTOR DESIGNED TO REMAIN SUBCRITICAL IF IMMERSED IN WATER 
OR OTHER FLUIDS 

• SIGNIFICANT EFFECTIVE NEGATIVE POWER COEFFICIENT OF 

REACTIVITY INCLUDED 

. NO CREDIBLE LAUNCH ACCIDENT CAUSES CRTICALITY 

• NO REACTOR OPERATION UNTIL STABLE FLIGHT PATH ACHIEVED 
. TWO INDEPENDENT SHUTDOWN SYSTEMS 

. INDEPENDENT DECAY HEAT REMOVAL PATH 

. UNIRRADIATED FUEL POSE NO SIGNIFICANT ENVIRONMENTAL HAZARD 
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Figure 4 



TERRESTRIAL SAFETY 


• NUCLEAR ELECTRIC PROPULSION POWER PLANTS 

- THREE INDEPENDENT BARRIERS TO RADIOACTIVE MATERIAL RELEASE 

- INDEPENDENT DECAY HEAT REMOVAL SYSTEM 

- ADDITIONAL SAFETY CONTROLS AND INSTRUMENTATION 

. NUCLEAR THERMAL ROCKETS 

- LOSS-OF-COOLANT FLOW SYSTEM 

- SCRUBBERS TO CLEAN EXHAUST OF RADIOACTIVE MATERIALS 

- CONTAINMENT/CONFINEMENT UNCERTAIN 

- ADDITIONAL SAFETY CONTROLS AND INSTRUMENTATION 


Figure 5 

SP-100 FLIGHT SYSTEM 
KEY SAFETY REQUIREMENTS 


• MAINTAIN REACTOR SUBCRITICAL DURING ACCIDENTS AND DURING PERMANENT DISPOSAL 

- FUEUSAFETY ROD ALIGNMENT 

- LAUNCH PAD FIRES 

- EXPLOS'ONS 

- CORE IMPACTION 

• INTACT REENTRY FOR SPECIFIED INADVERTENT EVENTS 

- ESSENTIALLY INTACT BURIAL FOLLOWING INADVERTENT REENTRY 

• HIGH RELIABILITY FOR REACTOR SHUTDOWN 

• HIGH RELIABILITY FOR SHUTDOWN HEAT REMOVAL 

• RETENTION OF REACTOR STRUCTURAL INTEGRITY FOR LOSS-OF-COOLANT 

• SECURE COMMUNICATIONS AND INHIBITS TO PREVENT REACTOR STARTUP PRIOR TO 

OPERATIONAL ORBIT 

• MINIMIUM USE OF HAZARDS, CHEMICALLY TOXIC MATERIALS 


ARE THE REQUIREMENTS THE SAME I 
FOR NEP POWER PLANTS? 1 
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SPACE-MANNED 


. CONTINUING TO OPERATE MAY BE SAFER THAN SHUTTING DOWN 
. MONITORING ASSESSMENT INSTRUMENTATION 


Figure 7 

SAFETY APPROACH 


. SYSTEMATICALLY DETERMINE THE EFFECTS OF ALL POSSIBLE 
FAILURES 

• ADVISE COUNTERMEASURES TO PREVENT A NUCLEAR ACCIDENT 

• ACCESS THE COST AND BENEFITS OF MITIGATION 

• RECOMMEND APPROPRIATE REMEDIES 


MUST START WITH INITIATION OF 
THE DESIGN PROCESS! 
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Figure 8 




POTENTIAL MISSION ACCIDENTS AND HAZARDS 


■■ NON-AC TIV A TED CORE 

7 PERMANENT DISPOSAL B 
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r- 


OPERATION t 

L 1 


• BOOSTER FAILURE 

• REENTRY AMO IMPACT 



5. TRANSFER TO | 
OPERATING 
ORBIT 


4 ASCENT TO 
PARKING ORBIT 


3 . LAUNCH PAO 



f jk i • SPACE DEBRIS IMPACTS 


• BOOSTER FAILURES 

• REENTRY AND IMPACT 



• MISSION ABORTS 

• REENTRY ANO IMPACT 


LAUNCH VEHICLE EXPLOSIONS 

• INTENSE FIRES 

• SHRAPNEL 



2. TRANSPORTATION 



Figure 9 


SAFETY CONCERNS 


. GROUND 
. LAUNCH 
. FLIGHT 

• DISPOSAL 

• PERCEIVED 
. LICENSING 
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Figure 10 








KEY SAFETY FEATURES 


REACTOR VESSEL 
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CONTROL SEGMENT 
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REACTOR SHIELD 


SUPPORT 

STRUCTURE 

STRUTS 
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ANO STARTER 
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STRUCTURAL 

INTERFACE 

RING 


• Control elements 
automatically shut reactor 
down upon loss ot power 

• Two Independent shutdown 
systems 

• Prompt negative reactivity 
coefficient assures stable 
reactor control 

• Only 4 out of 12 reflectors 
required for shutdown 

• Fresh core at launch 

• Large negative void coefficient 
enhances shutdown upon loss 
of coolant 

e Control elements moved 

Individually and in icremental 
amounts to prevent rapid 
reactivity addition 

• Rhenium poison provides 
thermal neutron absorption 
for water flooding 


KEY SAFETY FEATURES (CONT.) 


Figure 11 
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LAUNCH LOCK 
PREVENTS MOVEMENT 
OP OAS SEPARATOR 
DUNMQ LAUNCH 
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TEM POMPS ENSURE COOLANT 
riOW PON Of CAT NEAT REMOVAL 
WITHOUT EXTERNAL POWER 
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• EMCIVTFTIOM ANO OCCRVf TION Of VICES (TN 
MISSION NOOULCI ANO SHE CHIC COMMAND 
SEQUENCE OUARO AGAINST UNAUTHOR- 
IZED START-UP ANO OPERATION 

• INHIBITS ON SAPETT CRITICAL FUNCTIONS 

• MOM TORINO OP RRKMTS WHILE IN SIAM" ' 
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Figure 12 





GROUND OPERATIONS 


• KEY CONCERNS 

- PREVENT ACCIDENTAL CRITICALITY 

- AVOID LOSS OF SNM TO TERRORIST 

• WORKER CONSTRAINTS AROUND LAUNCH PAD 

• APPROACHES 

- ENGINE TRANSPORT 

- CORE HEAVILY POISONED 

- WATER-TIGHT STRUCTURE 

- SHIPPING VESSEL FOR "WORST" IMPACT ACCIDENT 

- SHIPPED IN PREFERENTIAL MANNER 

- LAUNCH PAD OPERATIONS 

- KEEP RADIOACTIVE LEVELS BELOW SAFETY LIMITS 

- REDUNDANT AND INDEPENDENT NEUTRON POISONS (E.G., POISON RODS IN COOLANT 
CHANNELS, LOCKED DRUM SUBSYSTEM) 

Figure 13 


LAUNCH OPERATIONS 


• KEY CONCERNS 

- PREVENT ACCIDENTAL CRITICALITY 

- AVOID FOREIGN COUNTRY ACQUIRING SNM 

• APPROACHES 

- REDUNDANT AND INDEPENDENT NEUTRON POISONS 

- ON-BOARD DESTRUCT DEVICES 

- FLIGHT PATH IN PREDETERMINED ZONES 
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Figure 14 




FLIGHT OPERATIONS 


• KEY CONCERNS 

- UNPLANNED REENTRY INTO BIOSPHERE 

- RADIOLOGICAL EFFECTS ON CREW 

- FISSION PRODUCT RELEASE 

- CONTINUING OPERATIONS TO GET HOME 

. APPROACHES 

- SELECT ANGLES OF THRUST TO ALWAYS MOVE TO SAFER ORBITS 

- SET ORBITS FOR SAFETY 

- INTERLOCKS 

- ENGINE DESTRUCT SYSTEM 

- REDUNDANT AND INDEPENDENT REACTOR CONTROL MODES (INCLUDING SET BACK 
MODES) 

- SHIELDING USING CONFIGURATION, LH2 IN TANK AND SPECIAL MATERIALS 

- ENCAPSULATED FUELS 

- REDUNDANT ENGINES/POWER PLANTS AND COMPONENTS F,gUI 


DISPOSAL 


. KEY CONCERNS 

- REENTRY INTO THE BIOSPHERE 

- CONTAMINATION OF LOW EARTH ORBIT 

. APPROACHES 

- DONT BRING IT BACK TO LOW EARTH ORBIT 

- SELECT ORBITS TO MINIMIZE RISK 
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Figure 16 



SP-100 RADIATION EXPOSURE vs. PROBABILITY 
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Figure 17 


PERCEIVED SAFETY CONCERNS 


• KEY CONCERNS 

- REAL AND PERCEIVED RISK CAN BE VERY DIFFERENT 

- EMOTIONAL ISSUE 

. APPROACHES 

- REDUCE REAL RISK TO VERY LOW LEVEL 

- OPERATIONAL SCENARIOS MUST BE PLAUSIBLE AND COMPLETE (EX. DISPOSAL) 

- EDUCATION OF CONCERNED GROUPS 

- AVOID DISCUSSIONS OF PROBABILITIES (USE ANALOGIES) 


436 


Figure 18 



LICENSING 




• KEY CONCERN 

- TIMELY LAUNCH APPROVAL 

. APPROACHES 

- CONSIDER SAFETY FROM THE START 

- WORK CLOSELY WITH IN PLACE APPROVAL PROCESS 


Figure 19 


SAFETY APPROVAL PROCESS 
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Figure 20 














NERVA DESIGN PHILOSOPHY 


"THE MAJOR DESIGN CRITERIA FOR THE NERVA ENGINE 
DEVELOPMENT PROGRAM SHALL BE RELIABILITY AND THE 
ACHIEVEMENT OF THE HIGHEST PROBABILITY OF MISSION SUCCESS. 
NEXT IN THE ORDER OF IMPORTANCE MUST BE PERFORMANCE AS 
MEASURED IN TERMS OF SPECIFIC IMPULSE. THEN THE ENGINE 
DESIGN SHOULD ATTEMPT TO KEEP THE OVERALL WEIGHT AS LOW 
AS POSSIBLE WITHIN THE BOUNDS ALLOWED BY FUNDS AVAILABLE 
FOR DEVELOPMENT. WHILE THERE ARE INTERRELATIONS BETWEEN 
THESE CRITERIA IN DESIGN, I CAN SEE NO BASIS FOFT ALTERING 
THEIR ORDER OF IMPORTANCE." 


MR. MILTON KLEIN (1967) 


Figure 21 

NERVA FLIGHT SAFETY PROGRAM 


. SAFETY PLAN (S-019) 

. FAULT TREE ANALYSIS 
PROCEDURES (S-01 9-002) 

. FLIGHT SAFETY CONTINGENCY 
ANALYSIS REPORT (S-103) 

. RELIABILITY ALLOCATION, 
ASSESSMENTS AND ANALYSIS 
REPORT (R202) 

. SINGLE-FAILURE-POINT 
REPORTING, ANALYSIS, 
CORRECTION AND CLOSEOUT 
(R101 - NRP-306) 
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Figure 22 


NERVA SAFETY PLAN 


THE MEANS FOR PREVENTING THE INADVERTENT ATTAINMENT OF REACTOR CRIT1CAUTV 
THROUGH ANY CREDIBLE COMBINATION OF FAILAURES, MALFUNCTIONS, OR OPERATU.S 
DURING ALL GROUND, LAUNCH, FLIGHT, AND SPACE OPERATIONS. 

A DESTRUCT SYSTEM DURING LAUNCH AND ASCENT TO ASSURE SUFFICIENT DISPERSION 
OF THE REACTOR FULE UPON EARTH IMPACT TO PREVENT NUCLER CRITICALITY WITH THE 
FUEL FULLY IMMERSED IN WATER. 

THE MEANS FOR PREVENTING CREDIBLE CORE VAPORIZATION OR DISINTEGRATION OR 
VIOLATION OF THE THRUST-LOAD PATH TO THE PAYLOAD. 

DIAGNOSTIC INSTRUMENTATION ADEQUATE TO DETECT THE APPROACH OF A FAILURE OR 
AN EVENT THAT COULD INJURE THE CREW OR DAMAGE THE SPACECRAFT AND THE 
PROVISIONS TO PRECLUDE SUCH AN EVENT. 

THE CAPABILITY FOR REMOTE OVERRIDE OF THE ENGINE PROGRAMMER BY THE CREW 
AND GRUND CONTROL AS WELL AS FOR REMOTE SHUTDOWN INDEPENDENT OF THE 
ENGINE PROGRAM. 

AN ENGINE CONTROL SYSTEM CAPABILITY TO PRECLUDE EXCESSIVE OR DAMAGING 
DEVIATIONS FROM PROGRAMMED POWER AND RAMP RATES. 

PROVIDE AN EMERGENCY MODE ON THE ORDER OF 30,000 Ib-thrusl, 500s SPECIFIC 
IMPULSE ANO 10® lb-sec TOTAL IMPULSE. 

Figure 23 


SUMMARY 


. POTENTIAL SOLUTIONS EXIST TO REDUCE RISK TO ACCEPTABLE 
LEVELS 

. THE COST OF SAFETY GOES UP DRAMATICALLY IF NOT CONSIDERED 
FROM DESIGN SELECTION AND INITIATION 

. PERCEIVE SAFETY CONCERNS MUST BE ADDRESSED 

. LICENSING PROCEDURES IN PLACE AND PREDICTABLE 

. OPERATIONAL CONSTRAINTS ARE SIMILAR TO CHEMICAL SYSTEMS 
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Figure 24 




